Security for vibe coders: ship your app without leaving the door open
You built a product with AI tools. Now keep it, and the server it runs on, from being taken over, leaked or wiped. Practical, source-backed guides in plain words, from the first deploy to the first incident.
Free and read-only: the check script reports problems and changes nothing on your server.
Start here
Vibe Coding Security Checklist: Protect Your App and Server
Nine steps in order: secrets, access control, dependencies, server lockdown, public ports, abuse limits, AI agents, backups and alerts.
Interactive checklist with progress
Tick items off as you go. Your progress is saved in your browser only. Print it or keep it open while you deploy.
Deploy it safely
Get from a laptop to a server without leaving the doors open.
How to Deploy a Node or Python App on a VPS Securely
Deploy a Node or Python app on a VPS securely: SSH keys, ufw firewall, a systemd service on 127.0.0.1, a 600 env file, nginx with HTTPS and outside checks.
Docker Compose on a VPS: A Secure Setup for Small Apps
Secure Docker Compose setup for a VPS: stop ports bypassing ufw, keep the database private, move secrets out of the file and verify it from outside.
SSH Hardening: Best Practices to Stop Brute-Force Attacks
A practical guide to hardening SSH on Linux VPS servers: key-based auth, sshd_config settings, ciphers, fail2ban, and firewall rules that stop brute-force attacks.
Linux Firewall Guide: iptables vs nftables vs ufw
A practical comparison of iptables, nftables, and ufw with setup steps, so you can pick and configure the right Linux host firewall.
Protect keys and data
The mistakes that let strangers read your data or spend your money.
Leaked an API Key on GitHub? What to Do in the First Hour
Pushed an API key or .env file to GitHub? Revoke the key first, check usage logs, redeploy, then clean Git history. A step-by-step emergency timeline.
Exposed .env and .git Files: How to Find Them, Block Them and Rotate Secrets
Check whether your web server exposes .env and .git files, block them in nginx or Apache without breaking Let's Encrypt, and rotate any secret that leaked.
Supabase Security Checklist: RLS, Keys and Storage
Supabase security checklist: turn on row level security for every table, write policies, protect the secret key, test as a visitor and lock down Storage.
Firebase Security Rules Checklist: Firestore and Storage
Firebase security rules checklist for Firestore, Storage and Realtime Database: replace test mode, lock data to owners, restrict API keys, add App Check, test.
Exposed Databases on a VPS: How to Lock Down MySQL, PostgreSQL, Redis and MongoDB
Why databases end up reachable from the internet, what each engine listens on by default, and the exact settings that keep MySQL, PostgreSQL, Redis and MongoDB private.
Work safely with AI tools
Keep coding assistants and agents inside limits you set.
Security Rules for AI Coding Assistants: Copy-Paste File
Copy-paste security rules file for Claude Code, Cursor and Copilot: 50 testable rules, where each tool reads them, how to test them and their limits.
AI Coding Agent Safety: Permissions, Sandbox, Injection
How to run Claude Code, Cursor or Copilot agents safely: separate user or container, deny rules for .env, sandbox, approvals, MCP trust, branches and backups.
Linux Users, sudo and Least Privilege on a VPS: A Practical Audit
Audit who has root on your Linux VPS: UID 0 accounts, sudo rules, NOPASSWD, service accounts with nologin, and a sudo privilege escalation to patch (CVE-2025-32463).
Back up, watch and respond
Survive a mistake, an attack or a bad deploy.
VPS Backup Strategy: The 3-2-1 Rule, Immutable Copies and Restore Tests
A practical VPS backup plan: what to back up, the 3-2-1 rule, why provider snapshots are not enough, append-only and object-lock copies, and how to test restores.
Server Monitoring and Log Analysis: Catching Attacks Early
What to monitor on a Linux server, how to separate signal from noise, and why centralized log analysis catches attacks earlier than logs sitting on disk.
How to Detect and Respond to a Server Breach
A practical, phase-by-phase guide to detecting, containing, eradicating, and recovering from a compromised Linux server.
DDoS Protection for Small Business Websites
A practical guide to DDoS attack types and realistic, budget-appropriate mitigation for small business Linux servers and websites.
Terms in plain words
Short definitions with the practical bit first.
Not sure where your server stands?
Run the free read-only check on your server, or talk to a security engineer about managed protection.
Get your free server checkTalk to a security engineerFrequently asked questions
What is vibe coding?
Vibe coding means describing what you want to an AI assistant and shipping the code it writes, often without reading every line. The speed is real, but code that runs is not automatically safe, so you still need to check secrets, access control, dependencies and the server.
Where should a vibe coder start with security?
Start with the vibe coding security checklist and the first two steps: keep secrets out of code and the browser, and check that every request is authorised on the server. Then lock down the server and set up backups.
Do I need a security expert to launch an AI-built app?
Not for the basics. Most of the checklist is configuration you can do yourself in an afternoon. Bring in an expert when the app holds customer data or payments and nobody on the team owns security.
Is there a free way to check my server?
Yes. Server Warden offers a free, read-only check script that reports exposed ports, risky settings and common mistakes in apps and Docker setups without changing anything on the server.